********************************



-----BEGIN PGP SIGNED MESSAGE-----



Microsoft Security Bulletin (MS00-070)

- --------------------------------------



Patch Available for Multiple LPC and LPC Ports Vulnerabilities



Originally posted: October 03, 2000



Summary

=======

Microsoft has released a patch that eliminates several security

vulnerabilities in Microsoft(r) Windows NT(r) 4.0 and  Windows(r)

2000. The vulnerabilities could allow a range of effects, from denial

of service attacks to, in some cases,  privilege elevation.



Frequently asked questions regarding this vulnerability and the

patch can be found at

http://www.microsoft.com/technet/security/bulletin/fq00-070.asp.



Issue

=====

Several vulnerabilities have been identified in the Windows NT 4.0

and Windows 2000 implementations of LPC and LPC ports:

 - The "Invalid LPC Request" vulnerability, which affects only

   Windows NT 4.0. By levying an invalid LPC request, it would

   be possible to make the affected system fail.

 - The "LPC Memory Exhaustion" vulnerability, which affects both

   Windows NT 4.0 and Windows 2000. By levying spurious LPC

   requests, it could be possible to increase the number of

   queued LPC messages to the point where kernel memory would

   be depleted.

 - The "Predictable LPC Message Identifier" vulnerability,

   which affects both Windows NT 4.0 and Windows 2000. Any

   process that knows the identifier of an LPC message can

   access it; however, the identifiers can be predicted. In the

   simplest case, a malicious user could access other process'

   LPC ports and feed them random data as a denial of service

   attack. In the worst case, it could be possible under certain

   conditions to send bogus requests to a privileged process in

   order to gain additional local privileges

 - A new variant of the previously-reported "Spoofed LPC Port

   Request" vulnerability. (For more information, please see

   http://www.microsoft.com/technet/security/bulletin/ms00-003.asp).

   This vulnerability affects Windows NT 4.0 and Windows 2000,

   and could, under a very restricted set of conditions, allow

   a malicious user to create a process that would run under

   the security context of an already-running process,

   potentially including System processes.



Because LPC can only be used on the local machine, none of these

vulnerabilities could be exploited remotely. Instead, a  malicious

user could only exploit them on machines that he could log onto

interactively. Typically, workstations and terminal  servers would be

chiefly at risk, because, if normal security practices have been

followed, normal users will not be allowed  to log onto critical

servers interactively. This also means that, even in the worst case,

the vulnerability would only confer  additional local - not domain -

privileges on the malicious user.



Affected Software Versions

==========================

 - Microsoft Windows NT 4.0 Workstation

 - Microsoft Windows NT 4.0 Server

 - Microsoft Windows NT 4.0 Server, Enterprise Edition

 - Microsoft Windows NT 4.0 Server, Terminal Server Edition

 - Microsoft Windows 2000 Professional

 - Microsoft Windows 2000 Server

 - Microsoft Windows 2000 Advanced Server

 - Microsoft Windows 2000 Datacenter Server



Patch Availability

==================

 - Microsoft Windows NT 4.0 Workstation, Server, and Server,

   Enterprise Edition:

   http://www.microsoft.com/Downloads/Release.asp?ReleaseID=24650

 - Microsoft Windows NT 4.0 Server, Terminal Server Edition:

   To be released shortly

 - Microsoft Windows 2000 Professional, Server, Advanced Server,

   and Datacenter Server:

   http://www.microsoft.com/Downloads/Release.asp?ReleaseID=24649



Note: The Windows NT 4.0 patch can be installed on systems running

Service Pack 6a, and will be included in Service Pack 7.  The Windows

2000 patch can be installed on systems with or without Service Pack

1, and will be included in Service Pack 2.



Note: Additional security patches are available at the Microsoft

Download Center



More Information

================

Please see the following references for more information related to

this issue.

 - Frequently Asked Questions: Microsoft Security Bulletin MS00-070,

   http://www.microsoft.com/technet/security/bulletin/fq00-070.asp

 - Microsoft Knowledge Base article Q266433 discusses this issue

   and will be available soon.

 - Microsoft TechNet Security web site,

   http://www.microsoft.com/technet/security/default.asp



Obtaining Support on this Issue

===============================

This is a fully supported patch. Information on contacting Microsoft

Product Support Services is available at

http://support.microsoft.com/support/contact/default.asp.



Acknowledgments

===============

Microsoft thanks  BindView's Razor Team (http://razor.bindview.com)

for reporting these issues to us and helping us protect  our

customers. The issues involved in these vulnerabilities required

several months of detailed engineering, and BindView  worked closely

with us throughout the process. We'd like to thank them for their

ongoing commitment to responsible reporting  practices.



Revisions

=========

 - October 03, 2000: Bulletin Created.



- ---------------------------------------------------------



THE INFORMATION PROVIDED IN THE MICROSOFT KNOWLEDGE BASE IS PROVIDED

"AS IS" WITHOUT WARRANTY OF ANY KIND. MICROSOFT  DISCLAIMS ALL

WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING THE WARRANTIES OF

MERCHANTABILITY AND FITNESS FOR A PARTICULAR  PURPOSE. IN NO EVENT

SHALL MICROSOFT CORPORATION OR ITS SUPPLIERS BE LIABLE FOR ANY

DAMAGES WHATSOEVER INCLUDING DIRECT,  INDIRECT, INCIDENTAL,

CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF

MICROSOFT CORPORATION OR ITS  SUPPLIERS HAVE BEEN ADVISED OF THE

POSSIBILITY OF SUCH DAMAGES. SOME STATES DO NOT ALLOW THE EXCLUSION

OR LIMITATION OF  LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES

SO THE FOREGOING LIMITATION MAY NOT APPLY.



Last Updated  October 03, 2000



(c) 2000 Microsoft Corporation. All rights reserved. Terms of use.





-----BEGIN PGP SIGNATURE-----

Version: PGP Personal Privacy 6.5.3



iQEVAwUBOdptcI0ZSRQxA/UrAQH2Jgf+INzTccmFKM66Zhg+nvVrH1QnqitGde6u

yBrXlhJZLp+6n+Fl8CdvueEwL6sfpiltbHYJ/JyqvdFvJN7TLdDWa2gNfcoZh1is

F4HklQSZvdb+ddQwS7rBiLV0RwNzYLPVabxxRk/TnHqA8PFaZXy+Sd9/ygGhIgss

9SKFaCrLRaGM2p6vL/pTSrmv7Kup6g5qg7e8kK9H6aGXxw0XXic4RH0YEBROX3Oq

3o9QPfbfcqFr5dr8utixTsXBSlZRa6si27NzQRvglka/GrJPF9YTUodfQUYwr9mI

CAPJBPS1Uu9AyraKyD9bzNpvju53YoOeJU11dgYqBH4CsB8WX3u5CA==

=xASC

-----END PGP SIGNATURE-----



   *******************************************************************

You have received  this e-mail bulletin as a result  of your registration

to  the   Microsoft  Product  Security  Notification   Service.  You  may

unsubscribe from this e-mail notification  service at any time by sending

an  e-mail  to  MICROSOFT_SECURITY-SIGNOFF-REQUEST@ANNOUNCE.MICROSOFT.COM

The subject line and message body are not used in processing the request,

and can be anything you like.



To verify the digital signature on this bulletin, please download our PGP

key at http://www.microsoft.com/technet/security/notify.asp.



For  more  information on  the  Microsoft  Security Notification  Service

please  visit  http://www.microsoft.com/technet/security/notify.asp.  For

security-related information  about Microsoft products, please  visit the

Microsoft Security Advisor web site at http://www.microsoft.com/security.